---
title: "SPF Record Setup: How to Configure SPF for Email (2026)"
description: "How to set up an SPF record for email: syntax, DNS steps for Cloudflare, GoDaddy and Namecheap, include values for 15 providers, and the 10-lookup limit."
canonical: "https://www.inboxkit.com/learn/spf-record-setup-email"
author: "Saksham Jain"
published: "2026-03-30"
updated: "2026-09-06"
category: "Guides"
---

# SPF Record Setup Guide: How to Configure SPF for Email (2026)

SPF records tell receiving servers which IP addresses can send email on behalf of your domain. Get it wrong and your emails go straight to spam. Here is the complete setup guide.

## What Is an SPF Record?

**SPF (Sender Policy Framework)** is a DNS TXT record that lists the mail servers authorized to send email from your domain. When a receiving server gets an email from your domain, it looks up the record and checks whether the connecting server's IP is on the list.

If the sending server is not listed, the email fails SPF. On its own an SPF failure is a soft signal, but combined with a [DMARC policy](/learn/dmarc-setup-email) it decides whether the message is delivered, quarantined to spam, or rejected. SPF is one of the three authentication records every sending domain needs; [SPF, DKIM and DMARC explained](/learn/email-authentication-spf-dkim-dmarc-explained) covers how the three work together.

A complete SPF record for a domain that sends only through Google Workspace looks like this:

`v=spf1 include:_spf.google.com ~all`

That one line says: version 1, trust whatever Google publishes as its sending servers, and treat everything else as a soft fail.

## SPF Record Syntax

Every SPF record is a single TXT record made of mechanisms evaluated left to right. The first mechanism that matches the sending IP decides the result.

| Component | Example | What it does |
|-----------|---------|-------------|
| **v=spf1** | `v=spf1` | Required prefix. Always `spf1` |
| **include:** | `include:_spf.google.com` | Authorizes another domain's published senders. Costs one DNS lookup plus whatever it includes |
| **ip4:** | `ip4:203.0.113.0/24` | Authorizes an IPv4 address or range. No lookup cost |
| **ip6:** | `ip6:2001:db8::/32` | Authorizes an IPv6 address or range. No lookup cost |
| **a** | `a` or `a:mail.example.com` | Authorizes the A record of the domain. One lookup |
| **mx** | `mx` | Authorizes the domain's MX hosts. One lookup plus one per MX host |
| **redirect=** | `redirect=_spf.example.com` | Replaces this record with another domain's record. One lookup |
| **~all** | `~all` | **Soft fail** for anything not listed. The safe default |
| **-all** | `-all` | **Hard fail** for anything not listed. Use once you are certain the record is complete |
| **+all** | `+all` | Authorizes everyone. Never use it; it makes SPF meaningless |

**Ready-to-use SPF records:**

| Setup | SPF record |
|-------|-----------|
| Google Workspace only | `v=spf1 include:_spf.google.com ~all` |
| Microsoft 365 only | `v=spf1 include:spf.protection.outlook.com ~all` |
| Google Workspace + Microsoft 365 | `v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all` |
| Google Workspace + a transactional ESP (SendGrid) | `v=spf1 include:_spf.google.com include:sendgrid.net ~all` |
| Own mail server on a fixed IP | `v=spf1 ip4:203.0.113.10 ~all` |

**Critical rule:** only **one** SPF record per domain. If two TXT records start with `v=spf1`, receivers return a permanent error and every message fails. Combine all senders into a single record.

## How to Set Up an SPF Record: Step by Step

**Step 1: List every service that sends as your domain.** Your mailbox provider (Google Workspace or Microsoft 365), any transactional ESP (SendGrid, Amazon SES, Postmark), any marketing platform (Mailchimp, HubSpot, Brevo), your helpdesk (Zendesk), your CRM, and any billing or ERP system that emails invoices. Most SPF failures come from a sender nobody remembered.

**Step 2: Collect each service's include value.** The table in the next section covers the common ones. Sequencers that send through your own Google or Microsoft mailbox do not need an include of their own; see the note under that table.

**Step 3: Build the record.** Start with `v=spf1`, add one `include:` per service (or `ip4:` for servers you control), and end with `~all`. Count the lookups: the total must stay under 10.

**Step 4: Add the TXT record at your DNS host.** Host or name is `@` (the bare domain), type is TXT, value is the full record. The next section shows where the fields are at Cloudflare, GoDaddy and Namecheap. If an SPF record already exists, edit it; do not add a second one.

**Step 5: Wait for the TTL to expire.** Most hosts default to 1 hour or less. Cloudflare changes are usually visible within minutes.

**Step 6: Verify.** Run the domain through the [SPF checker](/resources/tools/spf-checker) to confirm the record parses, the lookup count is under 10, and there is only one record. Then send a test to a Gmail address, open it, choose "Show original", and confirm `SPF: PASS`.

**Step 7: Add DKIM and DMARC.** SPF alone does not stop spoofing, because it checks the envelope sender, not the From address a recipient sees. Follow the [DKIM setup guide](/learn/dkim-setup-email) and the [DMARC setup guide](/learn/dmarc-setup-email) to finish authentication.

## Adding the TXT Record at Cloudflare, GoDaddy and Namecheap

The record is identical everywhere; only the form differs.

| DNS host | Where | Fields |
|----------|-------|--------|
| **Cloudflare** | DNS > Records > Add record | Type `TXT`, Name `@`, Content: the full record. TTL Auto. The proxy toggle does not apply to TXT records |
| **GoDaddy** | Domain > DNS > Add New Record | Type `TXT`, Name `@`, Value: the full record. TTL 1 hour |
| **Namecheap** | Domain List > Manage > Advanced DNS > Add New Record | Type `TXT Record`, Host `@`, Value: the full record. TTL Automatic |
| **Google Domains / Squarespace** | DNS > Custom records | Host name blank or `@`, Type `TXT`, Data: the full record |

Two details that catch people: paste the record without surrounding quotes unless the host's form shows quotes for existing TXT records, and if you send from a subdomain (for example `mail.example.com`), that subdomain needs its own SPF record with its own name in the Host field.

InboxKit publishes SPF, DKIM, DMARC and MX through Cloudflare automatically for every domain it manages, so on an InboxKit domain there is nothing to type. The [DNS checker](/resources/tools/dns-checker) shows every record it created.

## SPF Include Values by Provider

Include values below are the ones each provider documents at the time of writing. Providers occasionally change them, so confirm against the provider's own setup page before you publish, and re-check the lookup count afterwards.

| Provider | SPF include value | Approximate lookups |
|----------|-------------------|---------------------|
| **Google Workspace** | `include:_spf.google.com` | 4 |
| **Microsoft 365** | `include:spf.protection.outlook.com` | 2 |
| **Zoho Mail** | `include:zoho.com` (region-specific variants exist) | 1 |
| **Amazon SES** | `include:amazonses.com` | 1 |
| **SendGrid** | `include:sendgrid.net` | 1 |
| **Mailgun** | `include:mailgun.org` | 2 |
| **Postmark** | `include:spf.mtasv.net` | 1 |
| **Brevo** | `include:spf.brevo.com` | 1 |
| **Mailjet** | `include:spf.mailjet.com` | 1 |
| **Mailchimp** | `include:servers.mcsv.net` | 1 |
| **HubSpot** | Account-specific value shown under Settings > Domains and URLs | 1 to 2 |
| **Salesforce** | `include:_spf.salesforce.com` | 2 |
| **Zendesk** | `include:mail.zendesk.com` | 1 |
| **NetSuite** | `include:sent-via.netsuite.com` | 1 |
| **Broadcom / Symantec MessageLabs** | `include:spf.messagelabs.com` | 1 |

**Sequencers do not need an include.** Instantly, Smartlead, lemlist, SendKit and similar tools send through your own Google Workspace or Microsoft 365 mailbox over API or SMTP. The message leaves Google's or Microsoft's servers, which your record already covers. Adding an extra include for the sequencer wastes a lookup and, if the value is wrong, breaks the record. Only add an include for a service that sends from its own infrastructure.

**Example combined records:**

- Google Workspace + Amazon SES: `v=spf1 include:_spf.google.com include:amazonses.com ~all` (about 5 lookups)
- Google Workspace + Microsoft 365 + Zendesk: `v=spf1 include:_spf.google.com include:spf.protection.outlook.com include:mail.zendesk.com ~all` (about 7 lookups)

**InboxKit configures the correct SPF record automatically** for Google Workspace (**$2.50/mo**) and Microsoft 365 (**$2.50/mo**) mailboxes.

## The 10 DNS Lookup Limit and How to Fix PERMERROR

[RFC 7208](https://datatracker.ietf.org/doc/html/rfc7208) caps SPF evaluation at 10 DNS lookups. Every `include:`, `a`, `mx`, `redirect=` and `exists:` mechanism counts, and so does every nested include inside those. `ip4:` and `ip6:` cost nothing. Go over 10 and receivers return **PERMERROR**, which most gateways treat as a failure for every message, including the ones from senders that were correctly listed.

Google alone uses about 4 lookups. Add Microsoft 365 and two SaaS tools and you are at 9 or 10 before anyone notices.

**How to get back under the limit:**

1. **Remove senders you no longer use.** Old ESPs and abandoned tools are the usual culprits. Check DMARC aggregate reports to see which sources actually send.
2. **Replace includes with `ip4:` where the IPs are fixed.** Your own mail server or a dedicated-IP ESP can be listed by address at zero lookup cost.
3. **Move marketing and transactional mail to a subdomain.** Send newsletters from `news.example.com` with its own SPF record. Each subdomain gets its own 10-lookup budget, and a reputation hit on marketing mail stays off your primary domain.
4. **Flatten as a last resort.** Flattening replaces includes with the IPs they resolve to. It works, but providers change IPs without notice, so flattened records need re-checking on a schedule. Use it only with a service that re-flattens automatically.

The [SPF checker](/resources/tools/spf-checker) counts lookups for you and shows which include is responsible for each one.

## Common SPF Mistakes in Email

These are the **6 SPF errors** that cause the most deliverability damage in email setups:

| # | Mistake | What happens | How to fix |
|---|---------|-------------|------------|
| **1** | Too many DNS lookups (over 10) | PERMERROR: the record fails for every message | Remove unused includes, use `ip4:` for static IPs, move ESPs to a subdomain |
| **2** | Two SPF records on one domain | Both are invalid. **All email fails SPF** | Merge every sender into a single TXT record starting with `v=spf1` |
| **3** | Forgetting a service that sends as your domain | That service's mail fails SPF while everything else passes | Inventory every sender (helpdesk, CRM, billing, ERP) and add its include |
| **4** | Adding an include for a sequencer that sends through your mailbox | Wasted lookup, and a wrong value can break parsing | Remove it. Google or Microsoft already covers the sequencer |
| **5** | Typos: a space in the record, a missing `include:` prefix, `spf1` without `v=` | The record does not parse and is ignored | Copy the record from the provider's documentation, then validate it before publishing |
| **6** | Not updating after adding a service | New tool's email fails auth while old tools keep working | Re-audit SPF every time a new sending tool is connected |

**Quick diagnostic:** send a test email to Gmail, open it, click the three dots, choose "Show original". If SPF shows **FAIL** or **SOFTFAIL**, the sending server is missing from the record. If it shows **PERMERROR**, you have exceeded the 10-lookup limit or published two records. If it shows **NONE**, the record is not published on the domain the receiver checked, which usually means a subdomain mismatch.

## Soft Fail or Hard Fail: ~all vs -all

The last mechanism tells receivers what to do with a server you did not list.

- **`~all` (soft fail)** marks unlisted senders as suspicious without demanding rejection. It is the right choice while you are still discovering senders, and it is what Google and Microsoft recommend as a starting point. With DMARC in place, a soft fail still counts as an SPF failure for policy purposes, so you lose nothing in protection.
- **`-all` (hard fail)** tells receivers to reject unlisted senders outright. Move to it once DMARC aggregate reports have run for a few weeks and show every legitimate source passing. Switch too early and a forgotten billing system starts bouncing invoices.

For cold email domains that send only through Google Workspace or Microsoft 365, `~all` is the safe default and there is little to gain from `-all`. DMARC alignment, not the SPF qualifier, is what stops spoofing.

## Automatic SPF with InboxKit

**InboxKit configures SPF records automatically** when you create a mailbox. Here is what happens behind the scenes:

| Step | What InboxKit does | Time |
|------|-------------------|------|
| **1. Record creation** | Generates the correct SPF TXT record for your mailbox provider (Google or Microsoft) | Instant |
| **2. DNS publication** | Publishes the record to the domain's Cloudflare zone | Minutes |
| **3. Validation** | Verifies the record resolves and the lookup count is under 10 | Automatic |
| **4. Ongoing monitoring** | [InfraGuard](/email-deliverability) re-checks SPF, DKIM, DMARC and MX every six hours | Continuous |
| **5. Alert on changes** | Notifies you if a record is modified, deleted or stops resolving | Immediate |

This removes the most common source of deliverability problems: DNS that was right on day one and wrong by month three. For teams managing **50+ domains**, InboxKit saves roughly **8 to 10 hours** of manual SPF work per batch and prevents the copy-paste errors that break authentication.

## How to Verify Your SPF Record

**Check the record itself:**

1. Run the domain through the [SPF checker](/resources/tools/spf-checker). It confirms the record parses, counts the DNS lookups, flags duplicate records and lists every authorized source.
2. Run the [DNS checker](/resources/tools/dns-checker) to see SPF alongside DKIM, DMARC and MX, so a missing companion record is caught at the same time.

**Check a real message:**

3. Send a test email to a Gmail address, open it, click the three dots and choose "Show original". The summary box shows `SPF: PASS` with the IP that passed.
4. For any other provider, paste the raw headers into the [email header analyzer](/resources/tools/email-header-analyzer) and read the `Authentication-Results` line.

**Keep checking:**

5. Re-verify after every DNS change, every new sending tool, and every domain transfer. Registrar migrations silently drop TXT records more often than you would expect.

**InboxKit users:** InfraGuard runs steps 1 and 2 on every managed domain every six hours and alerts you when anything changes.

## Frequently asked questions

### What happens if my SPF record is wrong?

Emails fail SPF authentication. Depending on your DMARC policy, they go to spam or get rejected. A record with two entries or more than 10 lookups returns PERMERROR and fails every message, even from senders that were listed correctly. Always verify after making DNS changes.

### How many DNS lookups can an SPF record have?

Ten. Every include, a, mx, redirect and exists mechanism counts, including the ones nested inside an include. ip4 and ip6 entries are free. Google Workspace alone uses about four, so a domain with Google, Microsoft 365 and two SaaS tools is usually at the limit.

### Should I use ~all or -all?

Start with ~all. It marks unlisted senders as suspicious while you confirm every legitimate source, and with DMARC in place it gives the same protection. Move to -all only after a few weeks of DMARC reports show nothing legitimate failing.

### Do I need an SPF include for Instantly, Smartlead or lemlist?

No. Those tools send through your own Google Workspace or Microsoft 365 mailbox, so the message leaves Google's or Microsoft's servers, which your existing include already authorizes. Only services that send from their own infrastructure, such as SendGrid, Amazon SES or Mailchimp, need their own include.

### How long does an SPF record take to work?

As soon as the TXT record propagates, which is typically minutes on Cloudflare and up to an hour on registrars that default to a 3600-second TTL. Send a test to Gmail and use Show original to confirm SPF: PASS before assuming it is live.

### Does SPF stop email spoofing on its own?

No. SPF checks the envelope sender (the Return-Path), not the From address recipients see, so a spoofer can pass SPF on their own domain while displaying yours. DMARC alignment closes that gap by requiring the SPF or DKIM domain to match the visible From domain.

### Does InboxKit set up SPF automatically?

Yes. InboxKit publishes SPF, DKIM, DMARC and MX through Cloudflare when it creates mailboxes, validates the lookup count, and InfraGuard re-checks the records every six hours.

### Can I have multiple SPF records?

No. Only one SPF record per domain. Two records cause a permanent error and both are ignored. Combine every authorized sender into a single TXT record. Subdomains that send mail get their own single record.

## Sources

- [RFC 7208 - Sender Policy Framework (SPF)](https://datatracker.ietf.org/doc/html/rfc7208) (2014)
- [Google Workspace Admin Help - Set up SPF to prevent spoofing](https://support.google.com/a/answer/33786) (2026)
- [Microsoft 365 - Set up SPF to help prevent spoofing](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/email-authentication-spf-configure) (2026)
- [MXToolbox SPF Record Lookup](https://mxtoolbox.com/spf.aspx) (2026)
- [InboxKit DNS Setup Documentation](https://docs.inboxkit.com) (2026)
- [Cloudflare Docs - Create DNS records](https://developers.cloudflare.com/dns/manage-dns-records/how-to/create-dns-records/) (2026)
- [NIST SP 800-177 Rev. 1: Trustworthy Email (SPF, DKIM, DMARC and TLS guidance)](https://csrc.nist.gov/pubs/sp/800/177/r1/final) (2019)

## Related

- https://www.inboxkit.com/learn/dkim-setup-email
- https://www.inboxkit.com/learn/dmarc-setup-email
- https://www.inboxkit.com/learn/email-infrastructure-setup-guide